UK authority on cyber security and resilience
The National Cyber Security Centre says UK organisations have had vulnerable tech exploited, with several European supermarkets reporting fridge failures. UK officials warn AI-enabled threats loom as critical infrastructure remains under threat and urges rapid investment in safer tech.
Federal agencies and state officials have reported coordinated cyberattacks that have targeted internet-connected controllers at water and wastewater utilities in at least a dozen states since late July. Operators have had passwords changed and been locked out, forcing many plants to revert to manual control; officials say drinking water remains broadly safe while investigations continue.
The UK government has confirmed that Iranian-linked hackers targeted a small-scale energy generator last month. The incident did not threaten the wider energy system, and authorities have issued guidance to power firms while expanding cyber resilience plans, including an AI-powered shield for critical infrastructure.
The Foreign, Commonwealth and Development Office has appointed Lindy Cameron as its permanent secretary. She has led international diplomacy and development roles and is moving to steer the department through restructuring and budgetary pressures. The appointment comes as other top civil-service moves reshape Whitehall.
Western intelligence agencies warn that Iran's state-linked hackers have used CHOSEN BRICK spyware to steal emails, messages and device data via spear-phishing on WhatsApp and Telegram, with victims linked to dissidents and activists. The advisories from the FBI, NCSC and AIVD say the operation has been active since Autumn 2023, with further developments this year.
Asos has identified a breach affecting basic personal data via a third-party platform. Names, addresses, phone numbers, emails and customer search queries may have been accessed. Snowflake reports no platform compromise. Investigations and advisories are ongoing.
Security researchers have found two critical vulnerabilities in the PHP programming language, labelled PHP2Shell, and PHP maintainers have released emergency patches. Governments and major tech firms have urged operators to update immediately or temporarily take sites offline after AI-assisted research and an early public leak triggered millions of exploitation attempts between 21–27 October 2026.
Vulnerabilities in PHP, a core technology powering about 70% of websites, have prompted governments and major sites to take systems offline to patch critical flaws. OpenAI researchers credit frontier AI with help in discovering the bugs, and cybersecurity teams warn that exploitation could allow data theft and server takeover. Patches have been issued, and authorities urge immediate updating.
Since early November, dozens of supermarkets in Belgium, Sweden, Luxembourg, Estonia and Ireland have had their refrigeration systems manipulated remotely, raising temperatures to about 50°C and forcing large-scale disposal of chilled and frozen food. Retailers including Ahold Delhaize, Carrefour, ICA and Coop have reported IT incidents while national cyber centres and police are investigating.
Multiple waves of cyberattacks have hit internet-connected refrigeration and cold-chain controllers across Europe and the United States since early November 2026, forcing retailers and blood banks to discard chilled stock and prompting a joint U.S. government warning that industrial refrigeration systems remain under active threat.